15. Purple Perspective: Execution Methods by Tim Schulz

### Overview In this presentation at Zeefcon, Tim Schulz, Adversary Emulation Lead at SCYTHE, discusses the critical role of execution methods in purple teaming and adversary emulation. While security testing frequently focuses on testing across different MITRE ATT&CK techniques, Schulz emphasizes drilling down into testing depth by systematically exploring execution method variants for a single technique. Adversaries often swap execution methods rather than engineering entirely new capabilities, exploiting the flexibility, legacy support, and telemetry inconsistencies of underlying operating systems to evade detection.

### Key Topics - **Execution Methods and Telemetry Inconsistencies**: Operating systems support numerous execution mechanisms (command line, PowerShell, WMI, Windows Native APIs). Telemetry differences between these methods create detection gaps and require defenders to assess the intent behind benign-looking behaviors. - **The Execution Method Lifecycle**: Illustrated through PowerShell's history—from its creation (v1 in 2006) and default inclusion in Windows 7 (v2 in 2009), to unintended offensive use (e.g., PowerShell Empire, DerbyCon research), vendor response via telemetry additions (Script Block Logging, Module Logging, Constrained Language Mode), and subsequent offensive research into newer evasion vectors. - **Purple Team Testing Methodology**: Isolating variables by focusing on a single technique (such as Process Discovery, T1057) and altering only the execution method. Schulz outlines questions covering technique execution, endpoint artifacts, log sources, and analysis correlation. - **Testing Infrastructure and Tooling**: Setting up testbeds, data generators (e.g., Atomic Red Team, Caldera, Slingshot VM, C2 Matrix, PurpleSharp), collectors (Sysmon, Winlogbeat, Zeek), and analytic platforms (Elastic/ELK stack, Sigma rules, Red ELK, Security Onion).

### Technical Details Schulz demonstrates testing variants using Process Discovery (`Get-Process`) and LOLBAS tools: - **Bypassing Logging**: Performing downgrade attacks targeting PowerShell v2 to circumvent modern logging, or prepending commands with spaces (e.g., 500 characters) to exploit log truncation limits. - **Obfuscation**: Utilizing built-in Base64 encoding or advanced syntax manipulations using tools like Invoke-Obfuscation to disrupt string-based pattern matching. - **Binary Path & Naming Alterations**: Relocating executables like `powershell.exe` to user profiles or renaming them to test whether detections rely on static paths or binary names. - **Unmanaged Execution**: Executing code without the standard binary wrapper (e.g., Unmanaged PowerShell / PowerPick), directly invoking underlying assemblies such as `System.Management.Automation.dll`. - **Bring Your Own DLL & Signature Manipulation**: Bringing custom-named signed DLLs, or using projects like `windows-signed-binary` to alter file hashes while preserving valid Microsoft digital signatures to bypass hash-based blocking and allowlists. - **Living Off the Land Binaries (LOLBAS)**: Highlighting tools like `MSBuild.exe` to execute payloads and bypass application whitelisting, noting architecture differences (32-bit vs. 64-bit paths) and the necessity of correlating endpoint actions with network telemetry (e.g., flagging suspicious outbound network calls from utilities like Notepad or MSBuild).

### Takeaways - Testing depth by varying execution methods provides a clear maturity map for enterprise logging and detection capabilities. - Security teams should hold techniques constant during testing and change only one execution variable at a time. - Because attackers seek minimal effort for maximal gain, defenders must test assumptions across obfuscation, renaming, downgrade paths, unmanaged execution, and signed living-off-the-land binaries.